The composer decides what a chat is, and the topbar stops trying

The mode select in the topbar posted with hx-post against a route that only
answers PATCH, so every change returned 405 and the mode never moved. htmx
shows nothing when a request fails, so the control looked like it worked: the
select stayed where you put it and the server ignored you. It has never worked.

Two more of the same kind. A mode could not be chosen at all until the chat
existed, so reaching Plan meant sending something in Manual first and letting
the model answer under the wrong rules. And the project directory box was real
and submitted, but unlabelled and squeezed to a few characters by the select
beside it, so it read as broken -- which is how it was reported.

So the kind, the connection, the directory and the mode move out of the strip
above the text and into one toolbar row beneath it, where attach and send
already are. The directory becomes a button that opens a browser over SFTP,
because a path is something you would rather find than spell. `scan_dir` is new
beside `list_dir`: a picker has to tell a directory from a file before it can
draw the row, and `list_dir` backs a tool whose contract is a list of names and
must not change under a model mid-conversation.

Browsing is a person clicking, not a model calling, so it does not pass through
policy.py -- the same argument the terminal panel rests on. It does mean Manual
mode has a second exception now.

Also: .chip was two components with one name, and the attachment card won, so
the Chat/Agent pills silently wore its padding. --radius-md was used twice and
declared nowhere, so both fell back to 0. .btn.is-active has been set by
syncToggles since the terminal landed and styled by nothing. Enter-to-send
ignored isComposing, so committing an IME candidate sent the message. The
terminal had five colours of a sixteen-colour palette, with fallbacks from a
palette that no longer exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/api/agents.py

@@ -194,6 +194,69 @@ async def profile_page(
     return _detail(request, db, user, profile, is_new=False, saved=saved)
 
 
+@router.get("/api/agents/{profile_id}/browse")
+async def browse_profile(
+    request: Request, db: Db, user: RequiredUser, profile_id: str, path: str = ""
+):
+    """One directory on the far side, as a fragment the picker swaps in.
+
+    Hung off the profile rather than the chat because the commonest caller is
+    the *new*-chat composer, where there is no chat yet -- the directory is one
+    of the things being chosen. Ownership of the profile is the whole
+    authorisation, as everywhere else in this module.
+
+    This is a person clicking, not a model calling, so it does not go through
+    `agent/policy.py`. That is the same argument the terminal panel rests on and
+    it holds for the same reason -- somebody who owns the credential could list
+    the directory with an ssh client -- but it does mean Manual mode's promise
+    that everything is shown to you first now has a second exception. Both are
+    written down in CLAUDE.md.
+    """
+    profile = _profile(db, user, profile_id)
+    entries: list = []
+    error = ""
+
+    if hint := ssh_service.available():
+        error = hint
+    elif not profile.host_key:
+        # connect_kwargs would raise the same thing, but a picker that opens on
+        # a wall of prose about known_hosts is worse than one that says this.
+        error = "This connection's host key has not been confirmed yet. Check it first."
+    else:
+        try:
+            executor = ssh_service.SshExecutor(ssh_service.spec_from(profile), "")
+            entries = await executor.scan_dir(path or profile.default_dir or "/")
+        except ExecError as exc:
+            error = exc.message
+
+    here = path or profile.default_dir or "/"
+    return render(
+        request,
+        "agents/_browse.html",
+        {
+            "profile": profile,
+            "here": here,
+            "parent": _parent_of(here),
+            "entries": entries,
+            "error": error,
+        },
+    )
+
+
+def _parent_of(path: str) -> str:
+    """The directory above, or "" at the root.
+
+    Plain string work rather than pathlib: these are POSIX paths on somebody
+    else's machine, and running them through a local Path would apply this
+    host's rules to them.
+    """
+    trimmed = (path or "/").rstrip("/")
+    if not trimmed or trimmed == "":
+        return ""
+    head = trimmed.rsplit("/", 1)[0]
+    return head or "/"
+
+
 @router.post("/api/agents/{profile_id}/check")
 async def check_profile(request: Request, db: Db, user: RequiredUser, profile_id: str):
     """Look at the host's key, and connect if it has already been accepted.

src/lembas/api/chats.py

@@ -68,12 +68,19 @@ def _new_chat(
     kind: str = KIND_CHAT,
     ssh_profile_id: str = "",
     project_dir: str = "",
+    agent_mode: str = "",
 ) -> Chat:
     """Create a chat row, resolving which model it should use.
 
     An agent chat's connection is settled here and never again. That is the
     lock: the harness, the tools offered and the approval loop all differ, so a
     conversation whose earlier turns ran somewhere else is not one conversation.
+
+    The mode is *not* part of that lock and is accepted here so it can be chosen
+    before the first word. Without it, reaching Plan mode meant starting a chat
+    in Manual, sending something to make the chat exist, and only then being
+    offered the control -- by which point the model had already answered under
+    the wrong rules.
     """
     chosen = None
     if model_id:
@@ -96,6 +103,12 @@ def _new_chat(
         ssh_profile_id=profile.id if profile is not None else None,
         project_dir=(project_dir.strip() or profile.default_dir) if profile is not None else "",
     )
+    # Ignored rather than refused when it is not a mode, matching how every
+    # other bad value here collapses: somebody who mistypes should get a chat
+    # under the safest rules, not an error page holding their message hostage.
+    # Left alone entirely on a plain chat, where it means nothing.
+    if profile is not None and agent_mode.strip() in agent_policy.MODES:
+        chat.agent_mode = agent_mode.strip()
     db.add(chat)
     db.commit()
     return chat
@@ -113,6 +126,7 @@ async def start_chat(
     kind: str = Form(KIND_CHAT),
     ssh_profile_id: str = Form(""),
     project_dir: str = Form(""),
+    agent_mode: str = Form(""),
 ) -> Response:
     """Create a chat from its first message.
 
@@ -134,6 +148,7 @@ async def start_chat(
         kind=kind,
         ssh_profile_id=ssh_profile_id,
         project_dir=project_dir,
+        agent_mode=agent_mode,
     )
 
     user_message = chat_service.create_message(db, chat, ROLE_USER, content)